Experts opinion needed

[bira]

Hi Folks,

I could use some ideas and opinions here.

Our website recently moved to subscription only. Editorial content (weekly magazine and the daily news service) is login-protected.

The procedure for user authentication uses cookies.

At the top of every page I have the following:

/* no cache headers to make sure the page isn't stored on a proxy */
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");             
header("Last-Modified: " . gmdate("D, d M Y H:i:s") . "GMT"); 
header("Cache-Control: no-cache, must-revalidate");           
header("Pragma: no-cache"); 
/* the login-checker include */                                
require("$DOCUMENT_ROOT/subs/login.inc.php"); 

login.inc.php looks like this (cut for brevity):

if ($HTTP_COOKIE_VARS[webuserid]=="") {
    // redirect to a login form
} else {
   /* check the user's details in the database and assuming evertyhing is alright, 
then do nothing (in other words the rest of the page is displayed) */
} 

Now this works just fine for me on IE5.5, Netscape 4.76, Opera 5.02 and I even tested it on Lynx.

But, there are SOME users who claim that, even though they have checked the option to store their info in a cookie (auto-login), they are asked to log in every so often.

I don't know how to address this, and I don't know what I am doing wrong.

The actual setcookie when they log in is:

setcookie(webuserid,$myquery[userid],$expire,"/",".atlasf1.com");
setcookie(webpassword,md5($myquery[password]),$expire,"/",".atlasf1.com"); 

Whereby $expire is either 0 (if they don't want auto-login) or their subscription's expiration date (normally a year from now).


Since many here have extensive experience with using cookies to authenticate a user, I could use your ideas on what would be the reason some people are experiencing problems?

Thank you,

Bira

[Mas*Mind]

Strange, the phpcode looks allright...

Maybe changing the cookie-domain would solve your problem? Not that it looks wrong, but you'll never know.

Are there any specific browsers involved in the users who encounter this problem btw?

[John]

Welcome the the fun world of cookies!

I would recommend that you try setting your cookie domain to "" (ie nothing), unless you really need it on other subdomains, because setting it as you have seems to cause no end of troubles.

John

[bira]

Hi John, Mas*Mind,

First -- thank you for posting!

Mas*Mind -- the complaints seem to come sporadically and have absolutely nothing in common. It's completely random

John: In vB I have the domain set at .atlasf1.com - because I use the same mechanism for www.atlasf1 and my.atlasf1

In the subscription I kept the same pattern, because I am going to use it in My Atlas (my.atlasf1) as well is Bet Your Nuts (nuts.atlasf1).

The thing that boggles me completely is that I don't have a single problem and have no clue why some are.


I set up a simple page check for them. It has this code:

<?php
echo "<b>Bulletin Board/My Atlas Cookie:</b><p>";

if (($HTTP_COOKIE_VARS[bbuserid]!="") && ($HTTP_COOKIE_VARS[bbpassword]!="")) {
    echo "<font color=green>Your Atlas F1 Bulletin Board Cookies are set\n";
} else {
    echo "<font color=red>You don't have any Atlas F1 Bulletin Board Cookie!</font>\n";
}

echo "<p><br><b>Subscription Cookie:</b><p>";

if (($HTTP_COOKIE_VARS[webuserid]!="") && ($HTTP_COOKIE_VARS[webpassword]!="")) {
    echo "<font color=green>Your Atlas F1 Subscription Cookies are set\n";
} else {
    echo "<font color=red>You don't have any Atlas F1 Subscription Cookie!</font>\n";
}

And a couple of users went to check and came back saying -- the BB cookie is green (it's set) and the subscription cookie is red.

sigh...

[bira]

ok, mystery solved

ALL these who complained about problems has two atlasf1 cookie files on their computer. One was a very old vBulletin one -- from before February 2001 -- and did not have the domain set.

Well, I'm able to tell my users how to fix this -- manually delete all instances of atlasf1 cookie files, and then do a clean log in on all systems.

By the way, for future reference if you are ever asked, here's a really helpful guide on how to delete cookie files in IE (all version, on all OSes.

http://support.microsoft.com/support/kb/articles/q278/8/35.asp

Cheers and thank you!

Bira